SQLiteQueryBuilder查询重载使用及setStrict相关技术疑问咨询

Hey there! Let's break down your questions about the third recommended security practice and why strict mode isn't enabled by default:

1. Implementing the third practice: Using query overloads instead of raw SQL strings #

Instead of fetching a raw SQL string with getQuery() and executing it manually, you should use one of SQLiteQueryBuilder's built-in query() overload methods directly. These methods handle query execution securely while honoring your strict mode and projection map settings automatically.

Safe implementation example: #

// Set up your builder with strict mode and projection map
SQLiteQueryBuilder builder = new SQLiteQueryBuilder();
builder.setStrict(true);
builder.setProjectionMap(yourProjectionMap); // Your pre-configured projection map
builder.setTables("your_target_table");

// Use the query() overload to execute directly
Cursor resultCursor = builder.query(
        yourSQLiteDatabaseInstance,
        new String[]{"allowed_column1", "allowed_column2"}, // Projection (filtered by your map)
        "filter_column = ?", // Selection criteria with placeholder
        new String[]{"user_provided_value"}, // Safe bound arguments
        null, // GROUP BY clause (optional)
        null, // HAVING clause (optional)
        "sort_column ASC" // ORDER BY clause (optional)
);

What to avoid: #

Steer clear of this approach, even if you've set up strict mode and a projection map:

// Not recommended - raw SQL string retrieval + manual execution
String rawSql = builder.getQuery(
        new String[]{"allowed_column1", "allowed_column2"},
        "filter_column = ?",
        new String[]{"user_provided_value"},
        null,
        null,
        "sort_column ASC"
).toString();
Cursor resultCursor = yourSQLiteDatabaseInstance.rawQuery(rawSql, null);

Why this matters: #

• Unbroken security checks: The query() methods enforce strict mode rules (like blocking unapproved columns) before executing the query. Retrieving raw SQL introduces a risk of accidental modification or tampering that could bypass these safeguards.
• Built-in injection protection: While getQuery() uses placeholders, the query() overloads eliminate any chance of mishandling SQL strings or arguments during manual execution—arguments are securely bound under the hood.
• Less room for error: You skip boilerplate raw SQL execution code, reducing the chance of human mistakes that could compromise security or query correctness.

2. Why Android doesn't enable strict mode by default #

The core reason is backward compatibility:

• Legacy apps built before strict mode existed often rely on relaxed query behavior. For example, they might query columns not listed in a projection map, or use syntax that strict mode would reject.
• Enabling strict mode by default would break these existing apps, causing crashes or unexpected behavior. Android prioritizes app stability and compatibility with older codebases, so strict mode remains an opt-in feature for developers who want to enforce stricter security and query standards.

内容的提问来源于stack exchange，提问作者Pitos